CVE-2011-3834 Integer overflow in n/a

Critical 9.3 Published 16 Dec 2011 Updated 6 Aug 2024

Remote attackers can execute arbitrary code via a crafted AVI file due to integer overflows in the Winamp media player.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2011-3834?

CVE-2011-3834 is a critical vulnerability in Nullsoft Winamp, published on 16 Dec 2011. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Multiple integer overflows in the in_avi.dll plugin in Winamp before 5.623 allow remote attackers to execute arbitrary code via an AVI file with a crafted value for (1) the number of streams or (2) the size of the RIFF INFO chunk, leading to a heap-based buffer overflow.

Weakness: CWE-189

Which versions are affected by CVE-2011-3834?

It affects 1 product.

Products include Nullsoft Winamp.

How do I fix CVE-2011-3834?

No fix has been published for CVE-2011-3834 yet. Limit exposure of the affected software until one is available.

Is CVE-2011-3834 being exploited?

There is no known exploitation of CVE-2011-3834 in the wild and no public exploit code.

All Nullsoft Winamp vulnerabilities

Sources

Also known as GHSA-wq42-fqc8-4mqg.